chore: add trusted PyPI publishing workflow

[Johnkothapalli]

Summary

• add a PyPI Trusted Publishing workflow for published releases and the existing v0.1.0 tag
• keep package building separate from the minimal-permission OIDC publishing job
• verify the selected tag matches package metadata and pin every third-party action to a commit
• document the exact pending-publisher values and release checklist

Validation

• ruff check .
• mypy
• pytest -q (12 passed, 91% coverage)
• python -m build
• python -m twine check --strict dist/*
• zizmor .github/workflows/publish-pypi.yml (no findings)
• exercised the tag syntax and package-version comparison under Bash

Deployment note

No package is published by this PR. Before manually publishing v0.1.0, the maintainer must add
the documented pending publisher in PyPI and approve the protected pypi GitHub environment.

AI assistance was used to prepare this maintenance change; all listed checks were run locally.